An internal audit report’s executive summary is the one page that almost every reader reads and many readers read alone. It should give the overall conclusion and rating within its first three sentences, explain in business terms why the results matter, summarize the findings as a few themes rather than a list, say plainly what is working, and end with what happens next: the actions, their owners and dates, and any disagreement. It should fit on one page, use no audit jargon, and put a number in every claim. A director who reads only the summary, on a phone, the night before the committee meeting, should be able to give an accurate account of the report.
This guide is about how to write that page. It covers who reads the summary and what they need, the five moves that make up a good one, the verdict-first opening with a phrase bank for every rating, how to turn a list of findings into themes, the one-sentence finding digest, how to explain a rating without apologizing for it, the section on what worked, the forward-looking close, style rules, three before-and-after makeovers, two annotated model summaries, the shorter version for the committee pack, and a checklist. The executive summary section of the site’s report template gives the three-paragraph skeleton this guide builds on, and the report examples show five complete reports, each with its own summary.
In this guide
- Who reads the executive summary, and for how long
- The anatomy: five moves in three paragraphs
- The verdict-first opening
- Theme over inventory
- The one-sentence finding digest
- Explaining the rating without apologizing for it
- What worked
- The forward-looking close
- Style rules for one page
- Before and after: three makeovers
- Summaries for other kinds of report
- Two annotated models
- The committee-pack version
- The final checklist
- Questions about audit report executive summaries
- Related guides
Who reads the executive summary, and for how long
Every internal audit report has several readers with different amounts of time and different questions. The site’s guide to the anatomy of an internal audit report sets out four; for the executive summary, what matters is how much of the page each of them will actually read.
| Reader | Time spent on the report | What they read | The question they need answered |
|---|---|---|---|
| Audit committee member | Two minutes, often on a phone | The title, the rating and the first three sentences of the summary | Is something seriously wrong, and is it being fixed? |
| Executive responsible for the area | Ten minutes | The whole summary, then the findings that concern their teams | What does this mean for my area, and what have we committed to? |
| Process owner | As long as it takes | Everything, especially their own findings and actions | Is it fair, and what exactly do I have to do by when? |
| Future reader: next year’s auditor, a regulator, the external auditor | As long as it takes, months later | The summary first, to decide what to read next | What was concluded, on what basis, and what was not covered? |
The first row decides the shape of the summary. If the conclusion is not in the first three sentences, the reader who gives the report two minutes will not find it. That is the reason for the rule that the executive summary is written last and read first: it can only be written once the conclusion is settled, and it has to be written for the reader with the least time.
The anatomy: five moves in three paragraphs
The site’s report template structures the summary in three short paragraphs: why the work was done, what was found, and what happens next. Inside those paragraphs, a strong summary makes five moves. Each has a job and a characteristic way of failing.
| Move | Its job | Example | How it fails |
|---|---|---|---|
| 1. The reason | Say in one sentence why the area was audited, in business terms | “Drivers collect about 31 million dollars a year in cash and cheques, and a theft last year went undetected for five months.” | A restated objective (“to assess the adequacy of controls over route cash”) |
| 2. The verdict | Give the conclusion and the rating, unhedged | “Controls over route cash are not reliable: we rated the area Unsatisfactory.” | Activity instead of conclusion (“we reviewed the route settlement process at twelve depots”) |
| 3. The digest | Summarize the findings that drive the rating, as themes, with numbers | “At nine of twelve depots, the person who reconciled the cash was also the person who handled it, and 1,412 of 37,400 settlements had overrides approved by the person they benefited.” | A list of every finding, or findings with no numbers |
| 4. What worked | Say what was found to be effective | “Cash custody and bank deposit controls operated effectively at all depots.” | Omitted, which makes the criticism look less credible, not more |
| 5. What happens next | Actions, owners, dates, disagreement, and tracking | “Management has agreed eleven actions; the two most important are due by 30 June. Management has accepted the residual risk on one item, which the committee is asked to note.” | “Management has agreed to address the findings” |
The order of the moves is flexible within limits. Some functions, as in the site’s template, open with the reason; others open with the verdict. Either works if the verdict arrives within the first three sentences. What does not work is a summary that spends its first paragraph on background and scope, because the two-minute reader never reaches the verdict at all.
The verdict-first opening
The verdict sentence is the most important sentence in the report, and it is the one auditors most often hedge. “Overall, while certain opportunities for improvement were identified, controls were generally found to be operating as intended in most respects” contains a conclusion somewhere, but no reader can say what it is. The verdict should use the report’s own rating vocabulary, state the conclusion about the area rather than the audit, and say why in the same breath.
| Situation | A verdict that works |
|---|---|
| Satisfactory | “Controls over supplier payments are designed and operating effectively. We found no weaknesses that put the process’s objectives at risk.” |
| Needs improvement | “Controls over the financial close are generally effective, but two weaknesses in journal and reconciliation controls need prompt action. We rated the area Needs Improvement.” |
| Unsatisfactory | “Controls over route cash are not reliable. We rated the area Unsatisfactory because the main control that should detect a short deposit is not independent at nine of twelve depots.” |
| Improvement since the last audit | “Controls have improved since our 2024 audit: all four earlier findings are closed and working. One new weakness needs attention.” |
| Deterioration since the last audit | “Controls have weakened since our last audit, mainly because the new system removed two approval steps. We rated the area Needs Improvement, down from Satisfactory.” |
| Scope limitation | “We could not complete our work on the overseas subsidiary because its records were not made available in time. Our conclusion below covers the rest of the group only.” |
| Advisory engagement | “The proposed onboarding process would address most of the risks we identified, but three design gaps would leave sanctions screening incomplete for some customers.” |
The last row is a reminder that advisory work also needs a verdict, just not an assurance rating. Management asked internal audit for a view; the summary should give it in the first sentence.
Theme over inventory
A report with eight findings does not need eight sentences in the summary. It needs the two or three ideas that explain most of them. Grouping findings into themes is the hardest part of writing a summary and the part that most improves it, because a theme tells the reader what is wrong with the area, while a list only tells them what was wrong with the samples.
The technique is to look at the causes rather than the conditions. Findings that look different on the surface often share a cause, and the shared cause is the theme.
| Findings in the report | Shared cause | Theme sentence for the summary |
|---|---|---|
| Reconciliations reviewed by the preparer; overrides self-approved; deposit listings re-keyed without a check | Depot staffing assumed a separation of duties the depots did not have | “Several controls depend on a second person who, at most depots, does not exist.” |
| Access not removed for leavers; privileged accounts shared; access reviews late | Nobody owns access after the initial grant | “Access is granted carefully and then left unmanaged.” |
| Close tasks late; post-close journals high; reconciliations aged | Reconciliations fall behind, and the close fixes the consequences by entry | “The close is late because it is inaccurate, not in spite of it.” |
| Policies outdated; training incomplete; no monitoring reports | The function lost its compliance lead a year ago | “The compliance framework has not been maintained since the compliance lead left.” |
A theme sentence is not a vague summary. It must be supported by the findings, and the digest that follows it should give the numbers. But it is what a director will remember, and it points management at the cause, which is where the actions have to go. The site’s guide to root cause analysis covers how to find the shared cause.
The one-sentence finding digest
After the theme, the summary names the findings that drive the rating, each in one sentence. A good digest sentence has three parts: the condition with a number, the consequence in plain words, and the rating. Everything else, including the cause, the criteria and the action, is in the finding itself.
Weak. “We noted weaknesses in the reconciliation process which could result in misstatements.”
Digest. “Fourteen of 410 balance sheet accounts carried unexplained differences totaling 2.1 million pounds gross at year-end, and nine had carried the same items for six months or more (High).”
Weak. “Access controls require improvement.”
Digest. “Ninety-six employees who left in the year kept access to the finance system, four of them for more than three months after leaving (Medium).”
Weak. “There were issues with journal approvals.”
Digest. “About 190 journals a month were posted after the close deadline, and 22 top-side entries had no support beyond a spreadsheet reference (High).”
Two findings in the digest is usually right; three is the most a summary can hold. Low-rated findings almost never belong in the summary at all; they are in the report, and the summary can say how many there are.
Explaining the rating without apologizing for it
The rating is derived from the findings by the function’s published definitions, and the summary should show the derivation in one sentence, so that the reader sees a method rather than an opinion. The site’s template calls this the derivation sentence.
| Weak | Strong |
|---|---|
| “Based on our judgment, we have assigned a rating of Needs Improvement.” | “The rating reflects two high-rated findings on journal and reconciliation controls; under our definitions, a high finding with no compensating control on a key control would have produced Unsatisfactory, and the interim manual reviews introduced in August are why it did not.” |
| “Unfortunately, we have had to rate this area Unsatisfactory.” | “The area is rated Unsatisfactory because two high-rated findings concern the design of the controls that should detect a short deposit.” |
| “Although the rating is Needs Improvement, management is committed to addressing the issues.” | “The rating is Needs Improvement. Management has agreed actions for all seven findings; the most important is due in the first quarter.” |
Three things do not belong next to a rating: apologies (“unfortunately”), softeners (“although”), and hints that the rating was negotiated (“after discussion with management, the rating was revised”). A rating that follows its definitions needs no defense, and a rating that does not follow its definitions cannot be defended by adjectives. The site’s guide to finding severity ratings sets out how each finding’s rating is derived in the first place.
What worked
The sentence on what worked is not a courtesy. It tells the reader the boundaries of the problem, and it makes the criticism credible, because a report that finds nothing right anywhere is read as a report by auditors who were looking only for faults. It should be as specific as the findings.
- “Cash custody and bank deposits were controlled effectively at all twelve depots.”
- “The rebate accrual, one of the twelve material controls over financial reporting, was re-performed and fully supported.”
- “No preparer reviewed their own reconciliation, and daily reconciliations were on time on 94 percent of days.”
- “The payroll bank reconciliations were current and clean throughout the year.”
For a Satisfactory report, this sentence becomes the center of the summary, and it should prove the conclusion was earned: what was tested, over what population, and the most demanding test run. The clean payroll report in the site’s report examples shows how that works.
The forward-looking close
The final paragraph tells the reader what happens next. It has five possible parts, and the first two are essential.
| Part | Example |
|---|---|
| Actions and dates | “Management has agreed eleven actions. The two most important, independent reconciliation review and a system change to stop self-approval, are due by 30 June.” |
| Ownership | “The director of route accounting owns eight actions; the IT director owns three.” |
| Actions already taken | “Management introduced interim manual reviews of all overrides during the audit, which we have acknowledged in the report.” |
| Disagreement | “Management has accepted the residual risk of not sending statements to 1,130 customers until the system migration; we consider the risk higher, and the committee is asked to note both views.” |
| Tracking | “We will validate the High actions in the fourth quarter and report the results to the committee.” |
The third part is a requirement, not a courtesy: the Global Internal Audit Standards require the final communication to acknowledge actions that management has started or completed before the report is issued. The fourth part is where many summaries fail by omission. A disagreement between management and internal audit that appears only in the management response, on page twelve, will be missed by exactly the readers who need to see it.
Style rules for one page
| Rule | Why |
|---|---|
| One page, three paragraphs, at most about 300 words | Longer summaries stop being summaries |
| Conclusion within the first three sentences | The two-minute reader stops there |
| A number in every finding sentence, with its denominator | “14 of 410 accounts” is remembered; “some accounts” is not |
| No audit jargon: no IPE, TOE, key control, RCM | The committee member is not an auditor |
| Say what the control is, not its reference | “The review of reconciliations”, not “control FC-07” |
| Past tense for what was found, present tense for what is true now | “Reviews were not performed” (found); “the control is not reliable” (conclusion) |
| Active voice where there is an actor | “Management has agreed” rather than “it has been agreed” |
| No “we noted”, “it was observed”, “opportunities for improvement” | These phrases hide the finding |
| The same rating word as the rest of the report | A summary that says “adequate” in a report whose scale says “Satisfactory” creates a second scale |
| Write it last, read it aloud | Anything you stumble on aloud, a reader will stumble on silently |
The site’s guide to why audit reports put readers to sleep covers the wider readability rules, and the guide to writing audit conditions covers the sentence-level discipline behind the third row.
Before and after: three makeovers
Makeover 1: the activity summary.
Before. “Internal Audit performed a review of the accounts payable process in accordance with the approved audit plan. The objectives of the review were to assess the design and operating effectiveness of key controls over invoice processing, payment authorization and vendor master maintenance. Our procedures included walkthroughs, sample testing and data analytics. Several observations were noted, which are detailed in the body of this report, along with management’s action plans.”
After. “Supplier payments are generally well controlled, but changes to suppliers’ bank details are not, and that is where the organization is exposed to payment fraud. We rated accounts payable Needs Improvement. Of 520 bank-detail changes in the year, 88 had no independent call-back, and 1.2 million dollars was paid to changed accounts within ten days of the change (High). Invoice matching and payment approvals operated effectively across the 48,000 invoices we analyzed. Management has agreed to require call-back verification for every change by 31 March and to review the 88 changes now.”
Makeover 2: the hedged verdict.
Before. “Overall, while some areas for enhancement were identified, the control environment was found to be generally adequate, although certain control activities would benefit from strengthening in order to more fully mitigate the associated risks.”
After. “Controls over the close are generally effective, but journals posted after the deadline and reconciliations left unresolved need prompt action. We rated the area Needs Improvement.”
Makeover 3: the inventory.
Before. “Findings: 1. Reconciliation review not independent. 2. Overrides self-approved. 3. Sync failures not monitored. 4. Deposit listings re-keyed. 5. Customers not sent statements.”
After. “Several depot controls depend on a second person who, at most depots, does not exist. At nine of twelve depots the person who reconciled the cash had also handled it, and 1,412 of 37,400 settlements had overrides approved by the person they benefited (both High). Three further findings, all Medium, concern system sync failures, re-keyed deposit listings and customers who receive no statement.”
Summaries for other kinds of report
The five moves apply to every report, but their weight shifts with the report’s purpose. The table covers the formats most functions use besides the full assurance report.
| Report type | What the summary must do | What changes |
|---|---|---|
| Short-form report | Carry the whole message in one paragraph, because the report itself is two pages | Moves 2, 3 and 5 only; what worked in one clause |
| Follow-up report | Say which earlier findings are closed and working, which are open, and whether the area’s rating has changed | The verdict is about remediation: “Four of five findings are closed and the fixes are working; one is overdue and has been escalated” |
| Advisory report | Give the view management asked for, and what management should decide | No assurance rating; the verdict is a recommendation or an assessment of a design |
| Thematic or cross-cutting review | Name the pattern across units and where it is worst | The theme is the whole point; the digest names the units, not the findings |
| Continuous monitoring or analytics report | Say what moved since the last period and whether it needs action | Trend first: “Duplicate payments stopped at 0.02 percent of value for the third quarter running” |
The follow-up row deserves attention because follow-up reports are the ones committees read most carefully and the ones functions write least well. The reader wants to know whether the money and effort spent on remediation worked. The site’s report examples include a follow-up report, and the guide to management action plans covers what management should have committed to in the first place.
Two annotated models
The two summaries below are written for engagements described elsewhere on this site, and are annotated sentence by sentence.
Model A: a UK group’s financial close (Needs Improvement, two High findings). Pennine Foods plc, the 900-million-pound food manufacturer used across this site, had its financial close audited ahead of its first declaration on material controls under the UK Corporate Governance Code. The full engagement is in the guide to auditing the financial close.
“The group’s month-end close is slower and less accurate than the board has been told, and two of the weaknesses affect material controls in this year’s first declaration on internal controls. We rated the close Needs Improvement. The close is late because it is inaccurate: about 190 journals a month are posted after the day-eight deadline to fix what reconciliations did not catch, and 22 top-side consolidation entries had no support beyond a spreadsheet reference (High). Fourteen of 410 balance sheet accounts carried unexplained differences of 2.1 million pounds gross at year-end, and nine had carried the same items for six months (High). The board has been told the close takes eight days; the task logs show a median of eleven (Low). The rebate accrual, one of the material controls, was re-performed and fully supported, and seven of the nine entities’ consolidation packs are loaded directly from the ledger. Management has agreed actions for all nine findings, with the two High actions due before the December close, when the declaration is made.”
| Sentence | What it does |
|---|---|
| 1 | Verdict and why it matters now, in governance terms the board recognizes |
| 2 | The rating, in the report’s vocabulary |
| 3 | Theme (“late because it is inaccurate”) plus the first High, with numbers |
| 4 | The second High, with numbers |
| 5 | A Low that belongs in the summary because it concerns what the board is told |
| 6 | What worked, specifically, including a material control |
| 7 | What happens next, tied to the date that matters |
Model B: a bank’s reconciliation program (Needs Improvement, one High finding). Lakeshore Bancorp, the 9-billion-dollar regional bank used across this site, audited its reconciliation program partly because the audit committee had asked whether a problem found in wire operations was an exception or an example. The full engagement is in the guide to auditing reconciliations as a program.
“The committee asked whether last year’s wire suspense problem was an exception or an example. It was an example. Across about 3,100 accounts, differences that are not resolved are carried, then written off or cleared by journal entry, and eight of the people reconciling accounts can post to them. We rated the reconciliation program Needs Improvement, with one High finding: 312 items more than ninety days old totaling 8.7 million dollars gross, of which 41 worth 1.1 million dollars were unexplained, alongside 27 journals that cleared 640,000 dollars of differences to expense or intercompany. Twenty-two account owners certified accounts carrying unexplained differences older than ninety days without noting them (Medium). No preparer reviewed their own work, and daily reconciliations were completed on time on 94 percent of days. Management has agreed actions for all seven findings, starting with the clearing journals and posting rights.”
| Sentence | What it does |
|---|---|
| 1 and 2 | Answers the committee’s own question, in its own words, in the first eight words that matter |
| 3 | The theme: one mechanism behind several findings |
| 4 | Rating and the High finding, with the numbers that make it concrete |
| 5 | The Medium the committee will care about most, because certifications are what it sees |
| 6 | What worked |
| 7 | What happens next, starting with the highest risk |
The committee-pack version
Many functions summarize each report again in the audit committee pack, in fifty words or fewer. That version keeps only moves 2, 3 and 5: the verdict, one theme sentence with its key number, and the date that matters. For the Pennine report, it would read: “Financial close: Needs Improvement. The close is late because it is inaccurate, with about 190 post-deadline journals a month and 2.1 million pounds of unexplained reconciliation differences; two findings affect material controls in the first declaration. Actions due before the December close.” The guide to presenting to the audit committee covers how that paragraph is then delivered aloud.
The final checklist
1. Is the conclusion, with its rating, inside the first three sentences?
2. Could a director repeat the headline to the board in one sentence?
3. Are the findings summarized as themes, with at most three findings named?
4. Does every finding sentence have a number and a denominator?
5. Does the rating sentence show how the rating follows from the definitions?
6. Is there a specific sentence on what worked?
7. Are actions, owners and the key dates stated?
8. Are actions management has already taken acknowledged?
9. Is any disagreement stated here, not only in the management response?
10. Is it one page, free of jargon, and readable aloud without stumbling?
Questions about audit report executive summaries
How long should an executive summary be?
One page at most, usually about 200 to 300 words in three short paragraphs. If it runs longer, it is summarizing the report’s detail rather than its conclusion.
Should the executive summary list every finding?
No. It should summarize the findings that drive the rating, grouped into themes, and state how many other findings there are. Every finding is in the body of the report.
Should the executive summary include the management response?
It should include what management has agreed to do and by when, and any disagreement. The full response belongs with each finding.
When should the executive summary be written?
Last, after the findings, ratings and actions are settled. It is the only part of the report that depends on all the others.
Should the scope be in the executive summary?
Only briefly, and mainly to say what was not covered if a reader might assume it was. The full scope belongs in its own section.
What is the difference between an executive summary and an audit opinion?
The executive summary is the page that summarizes the report; the overall opinion or rating is one element within it. Some functions put the rating in a separate box above the summary, which works well if the summary’s first sentence still states the conclusion in words.
Should an executive summary use bullet points?
Sparingly. A short list of the two or three findings that drive the rating can be easier to scan than a paragraph, but a summary made entirely of bullets loses the connections between the points: why the findings matter together, what caused them, and what the rating means. Keep the verdict, the theme and the close as sentences.
Who approves the executive summary?
The chief audit executive, as part of the final report. The Standards require the CAE to review and approve the final engagement communication before it is issued, and in practice the summary is the part CAEs edit most, because it is the part the committee will read.
Related guides
- The internal audit report template set — the three-paragraph skeleton and the rating definitions.
- Internal audit report examples — five complete reports, each with an annotated summary.
- Anatomy of an internal audit report — the four readers and the eleven parts.
- Why your audit reports put everyone to sleep — readability for the whole report.
- How to write an internal audit report — the report from finding sheets to issue.
- Writing audit conditions — the numbers the digest depends on.
- Writing impact that lands — consequences in plain terms.
- Finding makeovers — five findings rewritten before your eyes.
- Finding severity ratings — the definitions behind the rating sentence.
- Root cause analysis for audit findings — finding the shared cause behind a theme.
- The audit closing meeting — where the summary’s facts are settled first.
- Presenting to the audit committee — the summary, delivered aloud.
- How to audit the financial close — the engagement behind Model A.
- How to audit account reconciliations as a program — the engagement behind Model B.
Leave a Reply